PBM Reform Cheat Sheet: Chart Comparing the Recent Rules for Group Plans

Key Takeaways:

Within a one-week period, there were two actions at the federal level to increase pharmacy benefits manager (PBM) transparency. The Consolidated Appropriations Act of 2026 (CAA 2026) and Department of Labor (DOL) proposed regulations on PBM compensation disclosures (DOL Proposed Rules) are complementary but differ in significant respects. CAA 2026 is broader in scope (applying to all group health plans, including fully insured arrangements), but has a later effective date and creates distinctions based on employer/plan size. In contrast, the DOL Proposed Rules only cover compensation disclosures and apply only to self-funded ERISA plans but would take effect much sooner and apply uniformly regardless of employer size.

From a compliance perspective, CAA 2026’s express civil penalties ($10,000 per day for non-disclosure; $100,000 per item for false information) provide a more direct enforcement mechanism, whereas the DOL Proposed Rules leverage the ERISA prohibited transaction framework, which can result in excise taxes and equitable remedies but lacks the same bright-line penalty structure.

Notably, CAA 2026 mandates 100% rebate pass-through for plans subject to ERISA, while the DOL Proposed Rules require only disclosure of rebates retained versus passed through — a key distinction for plan sponsors and industry actors.

Potential for DOL Regulatory Revisions:

Given the near-simultaneous issuance of CAA 2026 and the DOL Proposed Rules, there is significant potential for the DOL to revise its final rule to align with the statutory requirements enacted in CAA 2026. The DOL Proposed Rules were developed pursuant to Executive Order 14273 and build upon the existing ERISA Section 408(b)(2) framework, but the proposal was finalized before the DOL could fully account for the comprehensive PBM transparency and rebate pass-through requirements that Congress subsequently enacted in CAA 2026. As a result, the DOL will likely need to harmonize its disclosure requirements, timing provisions, and employer-size distinctions with those mandated by statute to avoid duplicative or conflicting obligations for plan sponsors, PBMs, and other covered entities.

Plan sponsors and PBMs should anticipate that the DOL’s final rule (expected after the comment deadline) may be significantly revised to coordinate with CAA 2026’s requirements. In particular, the DOL may need to reconsider its proposed July 1, 2026 applicability date, given that CAA 2026 does not take effect until January 1, 2029 for calendar-year plans, creating a potential gap period during which the DOL’s more limited disclosure requirements would apply to self-insured ERISA plans before the broader CAA 2026 mandates take effect — including 100% rebate pass-through for ERISA plans. Stakeholders should monitor the DOL’s response to public comments and any coordination efforts between the DOL and other federal agencies (including the U.S. Department of Health and Human Services) to ensure a unified regulatory approach to PBM oversight.

Comparison Table

The table below compares key elements of CAA 2026 and the DOL Proposed Rules.

Category	CAA 2026	DOL Proposed Rules
Effective Date	January 1, 2029, for calendar year plans. [Plan years beginning 30 months after enactment].	January 1, 2027, for calendar year plans. [Effective 60 calendar days after publication of the final rule; applicable to plan years beginning on or after July 1, 2026].
Applicability	Disclosure requirements apply directly to: (1) group health plans, (2) health insurance issuers offering group health insurance coverage, and (3) entities providing pharmacy benefit management services on behalf of such plans or issuers. Indirect application to “applicable entities” including drug manufacturers, distributors, wholesalers, rebate aggregators, applicable group purchasing organizations, and their subsidiaries, affiliates, or subcontractors. Rebate pass-through requirements apply to entities providing pharmacy benefit management services for ERISA plans (ropes in carriers, Third-Party Administrators (TPAs), rebate aggregators, and others).	Direct application to self-funded ERISA group health plans. Indirect application to “covered service providers” that contract with self-insured group health plans to provide pharmacy benefit management services. Covered service providers include: (1) PBMs and any entities providing pharmacy benefit management services; and (2) affiliates of PBMs that provide advice, recommendations, or referrals regarding PBM services. TPAs and health insurers that contract with plans to provide pharmacy benefit management services are also covered service providers responsible for making disclosures.
Employer Size Distinction	Large employers (100+ employees) and large plans (100+ participants) receive detailed drug-level PBM reports with contracted compensation, rebates, spread, and pricing data. Smaller employers/plans receive a more limited summary document with aggregate information.	Apply to all self-insured ERISA plans regardless of employer size.
Plans Covered	Group health plans (both fully insured and self-funded) and health insurance issuers under ERISA, the Internal Revenue Code, and the Public Health Service Act.	Self-insured ERISA group health plans only. Fully insured group health plans are explicitly excluded (reserved for future action).
Civil Penalties	Express civil monetary penalties: $10,000 per day for failure to disclose required information. $100,000 per item of false information knowingly provided. Penalties apply to PBMs, health insurance issuers, third-party administrators, and applicable entities.	Enforcement is through ERISA’s prohibited transaction framework under §408(b)(2). Non-compliance renders the service arrangement “unreasonable,” causing a prohibited transaction. DOL may bring civil actions under ERISA §502(a)(5) and assess penalties under ERISA §502(i).
Reporting Frequency	Semiannual reports (or quarterly at plan’s request).	Initial disclosures before entering/renewing contracts, semiannual disclosures (within 30 days after each six-month period), and disclosures of information for employer reporting upon request.
Information to be Disclosed	Detailed drug-level data for large employers/plans including: Contracted compensation (plan-to-PBM and PBM-to-pharmacy). Spread between amounts paid. Rebates, fees, and other remuneration by drug and therapeutic class. Gross and net drug spending. Broker/consultant referral fees. Benefit design parameters favoring affiliated pharmacies.	Similar disclosure categories including: Direct compensation (aggregate and by service). Manufacturer payments/rebates (aggregate and per drug). Spread compensation (aggregate, per drug, per pharmacy channel). Copay claw-backs. Price-protection payments. Fiduciary status and conflicts of interest. Drug-pricing methodology for formulary drugs.
Rebate Pass-Through Requirement	100% rebate pass-through required for ERISA plans only. Rebates must be remitted quarterly (within 90 days after quarter-end) to the plan or health insurance issuer. Rebates must be remitted quarterly (within 45 days after quarter-end) by rebate aggregators and group purchasing organizations. Full disclosure and enumeration to the plan required. “Rebates” include fees, alternative discounts, and other remuneration from any “applicable entity related to drug utilization or spending.”	No rebate pass-through mandate; disclosure only. The rule requires disclosure of rebate amounts retained vs. passed through but does not prohibit PBMs from retaining rebates.
Audit Rights	Annual rebate audit rights required for ERISA plans only. Rebate contracts with aggregators/manufacturers must be available for audit. Audits performed by an auditor selected by the plan fiduciary; PBM may not pay for the auditor.	Annual audit rights required. PBM must confirm receipt of audit request within 10 business days and provide information within a commercially reasonable period. Plan and PBM share the cost of the audit. Plan fiduciary selects the auditor; PBM may not limit audit choice or restrict number of records.
Fiduciary Relief/Safe Harbor	Innocent plan fiduciary exemption for failures attributable to PBMs, provided fiduciary did not know and reasonably believed compliance occurred.	Administrative class exemption for responsible plan fiduciaries if PBM fails to comply, provided fiduciary: Did not know of non-compliance and reasonably believed requirements were satisfied. Requests correction in writing upon discovery. Notifies DOL if not corrected within 90 days.
Legal Authority	Enacted through statutory amendment to the Public Health Service Act, ERISA, and Internal Revenue Code.	Administrative regulation under ERISA §408(b)(2)(A), §408(b)(2)(B), and §505.